diff --git a/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeysetManager.java b/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeysetManager.java
index 2f5bdde..1cc4c39 100644
--- a/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeysetManager.java
+++ b/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeysetManager.java
@@ -19,6 +19,7 @@
 import android.content.Context;
 import android.os.Build;
 import android.util.Log;
+import androidx.annotation.ChecksSdkIntAtLeast;
 import com.google.crypto.tink.Aead;
 import com.google.crypto.tink.CleartextKeysetHandle;
 import com.google.crypto.tink.KeyTemplate;
@@ -332,7 +333,9 @@
     }
   }
 
-  /** @return a {@link KeysetHandle} of the managed keyset */
+  /**
+   * @return a {@link KeysetHandle} of the managed keyset
+   */
   public synchronized KeysetHandle getKeysetHandle() throws GeneralSecurityException {
     return keysetManager.getKeysetHandle();
   }
@@ -469,6 +472,7 @@
     }
   }
 
+  @ChecksSdkIntAtLeast(api = Build.VERSION_CODES.M)
   private boolean shouldUseKeystore() {
     return masterKey != null && isAtLeastM();
   }
@@ -488,6 +492,7 @@
     }
   }
 
+  @ChecksSdkIntAtLeast(api = Build.VERSION_CODES.M)
   private static boolean isAtLeastM() {
     return Build.VERSION.SDK_INT >= Build.VERSION_CODES.M;
   }
diff --git a/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java b/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java
index 24dc591..6cc1592 100644
--- a/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java
+++ b/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java
@@ -20,6 +20,8 @@
 import android.security.keystore.KeyGenParameterSpec;
 import android.security.keystore.KeyProperties;
 import android.util.Log;
+import androidx.annotation.ChecksSdkIntAtLeast;
+import androidx.annotation.RequiresApi;
 import com.google.crypto.tink.Aead;
 import com.google.crypto.tink.KmsClient;
 import com.google.crypto.tink.subtle.Random;
@@ -53,6 +55,7 @@
   @GuardedBy("this")
   private KeyStore keyStore;
 
+  @RequiresApi(23)
   public AndroidKeystoreKmsClient() throws GeneralSecurityException {
     this(new Builder());
   }
@@ -64,6 +67,7 @@
    * @deprecated use {@link AndroidKeystoreKmsClient.Builder}.
    */
   @Deprecated
+  @RequiresApi(23)
   public AndroidKeystoreKmsClient(String uri) {
     this(new Builder().setKeyUri(uri));
   }
@@ -78,6 +82,7 @@
     String keyUri = null;
     KeyStore keyStore = null;
 
+    @RequiresApi(23)
     public Builder() {
       if (!isAtLeastM()) {
         throw new IllegalStateException("need Android Keystore on Android M or newer");
@@ -91,6 +96,7 @@
       }
     }
 
+    @RequiresApi(23)
     public Builder setKeyUri(String val) {
       if (val == null || !val.toLowerCase(Locale.US).startsWith(PREFIX)) {
         throw new IllegalArgumentException("val must start with " + PREFIX);
@@ -100,6 +106,7 @@
     }
 
     /** This is for testing only */
+    @RequiresApi(23)
     public Builder setKeyStore(KeyStore val) {
       if (val == null) {
         throw new IllegalArgumentException("val cannot be null");
@@ -119,6 +126,7 @@
    *     AndroidKeystoreKmsClient#PREFIX}.
    */
   @Override
+  @RequiresApi(23)
   public synchronized boolean doesSupport(String uri) {
     if (this.keyUri != null && this.keyUri.equals(uri)) {
       return true;
@@ -132,6 +140,7 @@
    * <p>Note that Android Keystore doesn't need credentials, thus the credential path is unused.
    */
   @Override
+  @RequiresApi(23)
   public KmsClient withCredentials(String unused) throws GeneralSecurityException {
     return new AndroidKeystoreKmsClient();
   }
@@ -142,6 +151,7 @@
    * <p>Note that Android Keystore does not use credentials.
    */
   @Override
+  @RequiresApi(23)
   public KmsClient withDefaultCredentials() throws GeneralSecurityException {
     return new AndroidKeystoreKmsClient();
   }
@@ -156,8 +166,8 @@
   public synchronized Aead getAead(String uri) throws GeneralSecurityException {
     if (this.keyUri != null && !this.keyUri.equals(uri)) {
       throw new GeneralSecurityException(
-          String.format("this client is bound to %s, cannot load keys bound to %s",
-              this.keyUri, uri));
+          String.format(
+              "this client is bound to %s, cannot load keys bound to %s", this.keyUri, uri));
     }
     Aead aead =
         new AndroidKeystoreAesGcm(
@@ -199,6 +209,7 @@
    *
    * <p>At the moment it can generate only AES256-GCM keys.
    */
+  @RequiresApi(Build.VERSION_CODES.M)
   public static Aead getOrGenerateNewAeadKey(String keyUri)
       throws GeneralSecurityException, IOException {
     AndroidKeystoreKmsClient client = new AndroidKeystoreKmsClient();
@@ -214,8 +225,8 @@
    *
    * <p>At the moment it can generate only AES256-GCM keys.
    */
-  public static void generateNewAeadKey(String keyUri)
-      throws GeneralSecurityException {
+  @RequiresApi(Build.VERSION_CODES.M)
+  public static void generateNewAeadKey(String keyUri) throws GeneralSecurityException {
     AndroidKeystoreKmsClient client = new AndroidKeystoreKmsClient();
     if (client.hasKey(keyUri)) {
       throw new IllegalArgumentException(
@@ -226,15 +237,15 @@
     }
 
     String keyId = Validators.validateKmsKeyUriAndRemovePrefix(PREFIX, keyUri);
-    KeyGenerator keyGenerator = KeyGenerator.getInstance(
-        KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
+    KeyGenerator keyGenerator =
+        KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
     KeyGenParameterSpec spec =
-        new KeyGenParameterSpec.Builder(keyId,
-            KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
-                .setKeySize(256)
-                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
-                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
-                .build();
+        new KeyGenParameterSpec.Builder(
+                keyId, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
+            .setKeySize(256)
+            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+            .build();
     keyGenerator.init(spec);
     keyGenerator.generateKey();
   }
@@ -255,6 +266,7 @@
     return aead;
   }
 
+  @ChecksSdkIntAtLeast(api = Build.VERSION_CODES.M)
   private static boolean isAtLeastM() {
     return Build.VERSION.SDK_INT >= Build.VERSION_CODES.M;
   }
diff --git a/java_src/src/main/java/com/google/crypto/tink/integration/android/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/integration/android/BUILD.bazel
index 61d3757..c6360c4 100644
--- a/java_src/src/main/java/com/google/crypto/tink/integration/android/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/integration/android/BUILD.bazel
@@ -13,6 +13,7 @@
         "//src/main/java/com/google/crypto/tink:kms_client",
         "//src/main/java/com/google/crypto/tink/subtle:random",
         "//src/main/java/com/google/crypto/tink/subtle:validators",
+        "@maven//:androidx_annotation_annotation",
         "@maven//:com_google_code_findbugs_jsr305",
     ],
 )
@@ -61,6 +62,7 @@
         "//src/main/java/com/google/crypto/tink:keyset_writer-android",
         "//src/main/java/com/google/crypto/tink:registry_cluster-android",
         "@com_google_protobuf//:protobuf_javalite",
+        "@maven//:androidx_annotation_annotation",
         "@maven//:com_google_code_findbugs_jsr305",
     ],
 )